A critical security flaw in PHP, the programming language powering millions of websites, triggered a global emergency response this week after two vulnerabilities were discovered. Microsoft CEO Satya Nadella said he had not seen a cyber-security crisis "in a long, long time."
IT workers on the frontlines reported extreme pressure as they raced to patch systems. Adam Mudd, a UK system administrator, said the experience had been "relentless." He lost significant sleep working until 22:30 BST coordinating updates across multiple client systems while managing requests to take websites offline as a precaution. Loganaden Velvindron, an IT administrator in Mauritius, said his team faced additional complications because many websites run end-of-life PHP versions, requiring code rebuilds rather than simple patches.
The PHP Foundation released a software fix at 15:00 BST on Wednesday, creating what Jon Jones, technical director of a digital advertising company, described as a race to download and deploy the patch. He noted the process carried inherent risk, as software updates can trigger other problems.
However, cyber experts now question whether the scale of the threat justified the intensity of the response. Leaks about the vulnerability details prompted widespread rumours that hackers possessed working attack methods. Daniel Card, a UK cyber expert, said his team was "flooded with rubbish intel" about active exploitation attempts. A major cyber-security firm issued warnings about working hacker methods only to retract them.
Cloudflare and AWS reported "millions of hacking attempts" per hour, but no evidence has emerged of large-scale data breaches or successful attacks at scale. Hackers have been observed using AI to attempt building attack methods, but none are currently working effectively.
AI itself discovered the PHP flaws, which had remained hidden from human researchers for decades. The incident highlights concerns about how future vulnerabilities will be communicated. Mark Maunder, founder of Wordfence security tool, warned of "alert fatigue" if messaging about vulnerabilities remains uncalibrated, risking public complacency when genuine threats emerge.